Crash when adding components to a player vehicle

[jeremyshannon]

Rose reported this on the forums, https://discourse.cataclysmdda.org/t/constant-crash-occurring/16769
The player vehicle seems to have become bugged, and adding certain components to it will cause an immediate segfault, with the bug first appearing somewhere between versions 7967-7975. Running on earlier versions does not crash. (Will bisect it this afternoon if time permits)

The save used a wide range of mods, but the crash is reproducible without them. The mod folder is also linked below.

Steps to reproduce the behavior:

1. Load the player's save, linked below
2. Wish up and attempt to install steel/military composite plating onto the player vehicle

Upd: taking military composites from a nearby tank and using them crashes the game too.
Upd2: taking steel plating from a nearby truck and using it also crashes the game.
Upd3: taking a cargo space from a lorry from a completely different area and installing it also crashes the game.

Versions and configuration(please complete the following information):

• OS: Windows 7 64 bit 0.C-32733-g0a83a2b (tiles),
  Debian Linux 9 64-bit 0.C-32733-g0a83a2b78c-dirty (ascii)

Additional context
Player's save game:
https://yadi.sk/d/ckinE4d77jz2MA
Player's mod folder:
https://yadi.sk/d/Jjt_GFbGNrCejw

[jeremyshannon]

Okay, I ran a bisect and here's where I ended up:

There are only 'skip'ped commits left to test.
The first bad commit could be any of:
892d9ceaed12774dfaa8b7df63fb18a82de6dfb4
eb56be835ee874c8a7b338a869558fa7dc29fa8a
1d277b15c5aca0171c39236dbc325facb84d37e0
59481a1e23c772225aeb8bc04bc6713ab73a4e6c
532c8c23e2994646a54b66e89ef1ce457d6e7aa9
faa8713e19b7cbc5899f3b2fa54839ba546d7376
a2d40f17180d27dd20cd8d6386da44009efc9d9a
ba3e6e9496dd649d4228d81efc5de5f34e0ba399
7e01bb02df17333816030434eeaf3a513f44bc22
We cannot bisect more!

It appears to be in the middle of mlangsdorf's bike rack merge. I had to skip a bunch of commits as they wouldn't compile due to, I think it was, USE_BIKE_RACK references.

There miiiight be two bugs here, because in later commits it crashed on installing the plate armor, but for a good stretch it would crash upon subsequently removing it.

[mlangsdorf]

Taking a look.

[mlangsdorf]

First try at bisecting it returned nonsense. Will take another look sometime tomorrow.

[chain2net]

Had same problem. I found what a problem is electricity. When I remove all batteries and solar panels a bug gone away.

[ZhilkinSerg]

I've had similar crash, though I was running without debugger, so I don't know which caused it. I've attempted to reproduced crash with same steps, but game failed to crash.

[eturner]

I'm having this problem right now. I managed to install a few military composite armors after repeated failed attempts, saving between each success, and now the game crashes within the next few turns no matter what I do.
My log looks a little different than hers.
I don't have "WARNING: Deprecated foreground color suffix was used [...]".
Just "couldn't parse color: c_black_light_red, couldn't parse color: c_magenta_light_cyan, couldn't parse color: c_yellow" then a bunch of "Empty locations for group GROUP_SEWER at uniform submap [...]"

[ZhilkinSerg]

@eturner Can you provide savegame and any custom mods you use? That would help.

[RosieMcCattail]

I'm in! Thanks to @jeremyshannon for posting my problem.

@eturner The errors in my log about colors appeared to be connected to The Mining Mod, and fixing the color names in the mod eliminated the errors from the log, but did not help with the vehicle at all.
I've also tried running the game without any mods, but as @jeremyshannon said, the bug is reproducible even on a clean version.

[mlangsdorf]

[mlangsdorf@redhatnow rose-bug-cat.git]$ git bisect good
892d9ce is the first bad commit
commit 892d9ce
Author: Mark Langsdorf mark.langsdorf@gmail.com
Date: Sun Sep 9 20:20:19 2018 -0500

vehicle bike racks: add the ability to merge a vehicle

Current rough theory: something is somehow getting a carried_flag, and vehicle_display is trying to get the substring of an emptied carried name string in vehicle_display.cpp. Doesn't make much sense but it's the only thing I've got right now.

[mlangsdorf]

running on 892d9ce, backtrace when moving after installing the cargo part:

Error: attempt to copy-construct an iterator from a singular iterator.

Objects involved in the operation:
    iterator "this" @ 0x0x474a358 {
      type = __gnu_debug::_Safe_iterator<std::__cxx1998::_List_iterator<item>, std::__debug::list<item, std::allocator<item> > > (mutable iterator);
      state = singular;
    }
    iterator "other" @ 0x0x3f6be48 {
      type = __gnu_debug::_Safe_iterator<std::__cxx1998::_List_iterator<item>, std::__debug::list<item, std::allocator<item> > > (mutable iterator);
      state = singular;
    }

Thread 1 "cataclysm-tiles" received signal SIGABRT, Aborted.
__GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
51	}

#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
#1  0x00007ffff65eed31 in __GI_abort () at abort.c:79
#2  0x00007ffff6f8a9a3 in __gnu_debug::_Error_formatter::_M_error() const ()
   from /lib64/libstdc++.so.6
#3  0x0000000000422c69 in __gnu_debug::_Safe_iterator<std::__cxx1998::_List_iterator<item>, std::__debug::list<item, std::allocator<item> > >::_Safe_iterator (__x=invalid iterator, this=0x474a358)
    at /usr/include/c++/7/debug/safe_iterator.h:145
#4  item_reference::item_reference (this=<optimized out>) at src/active_item_cache.h:13
#5  __gnu_cxx::new_allocator<std::__cxx1998::_List_node<item_reference> >::construct<item_reference, item_reference const&> (__p=<optimized out>, this=<optimized out>)
    at /usr/include/c++/7/ext/new_allocator.h:136
#6  std::allocator_traits<std::allocator<std::__cxx1998::_List_node<item_reference> > >::construct<item_reference, item_reference const&> (__p=<optimized out>, __a=...)
    at /usr/include/c++/7/bits/alloc_traits.h:475
#7  std::__cxx1998::__cxx11::list<item_reference, std::allocator<item_reference> >::_M_create_node<item_reference const&> (this=0x7fffffffc9c8) at /usr/include/c++/7/bits/stl_list.h:575
#8  std::__cxx1998::__cxx11::list<item_reference, std::allocator<item_reference> >::_M_insert<item_reference const&> (__position=..., this=0x7fffffffc9c8) at /usr/include/c++/7/bits/stl_list.h:1801
#9  std::__cxx1998::__cxx11::list<item_reference, std::allocator<item_reference> >::push_back (
    __x=..., this=0x7fffffffc9c8) at /usr/include/c++/7/bits/stl_list.h:1118
#10 active_item_cache::get (this=this@entry=0x3eee588) at src/active_item_cache.cpp:68
#11 0x0000000000c10a61 in map::process_items_in_vehicle (this=this@entry=0x3c47480, cur_veh=..., 
    current_submap=..., gridz=gridz@entry=0, 
    processor=processor@entry=0xc0c155 <process_map_items(item_stack&, std::__debug::list<item, std::allocator<item> >::iterator&, tripoint const&, std::__cxx11::string const&, int, float)>, 
    signal="") at src/map.cpp:4467
#12 0x0000000000c11e2f in map::process_items_in_vehicles (this=this@entry=0x3c47480, 
    current_submap=..., gridz=0, 
    processor=processor@entry=0xc0c155 <process_map_items(item_stack&, std::__debug::list<item, std::allocator<item> >::iterator&, tripoint const&, std::__cxx11::string const&, int, float)>, 
    signal="") at src/map.cpp:4440
#13 0x0000000000c1e33f in map::process_items (this=0x3c47480, active=active@entry=true, 
    processor=processor@entry=0xc0c155 <process_map_items(item_stack&, std::__debug::list<item, std::allocator<item> >::iterator&, tripoint const&, std::__cxx11::string const&, int, float)>, 
    signal="") at src/map.cpp:4387
#14 0x0000000000c1e456 in map::process_active_items (this=<optimized out>) at src/map.cpp:4369
#15 0x00000000008a3ceb in game::do_turn (this=0x3cb6910) at src/game.cpp:1620
#16 0x0000000000bf1da4 in main (argc=<optimized out>, argv=<optimized out>) at src/main.cpp:648

in active_items, that's

std::list<item_reference> active_item_cache::get()
{
    std::list<item_reference> items_to_process;
    for( auto &tuple : active_items ) {
        // Rely on iteration logic to make sure the number is sane.
        int num_to_process = tuple.second.size() / tuple.first;
        for( auto &an_iter : tuple.second ) {
            active_item_set[an_iter.item_id] = true;
            items_to_process.push_back( an_iter );
           ^^^^^ FAILING LINE
            if( --num_to_process < 0 ) {
                break;
            }
        }
    }
    return items_to_process;
}

called from map.cpp:

void map::process_items_in_vehicle( vehicle &cur_veh, submap &current_submap, const int gridz,
                                    map::map_process_func processor, std::string const &signal )
{
    static time_point last_fluid_check = calendar::time_of_cataclysm;
    const time_point now = calendar::turn;

    // only check the fluid every 10 turns for freeze/rot
    if( last_fluid_check - now > 10_turns ) {
        last_fluid_check = now;
        std::vector<int> tanks = cur_veh.all_parts_with_feature( VPFLAG_FLUIDTANK, false );
        for( const int &idx : tanks ) {
            const point partloc = cur_veh.global_pos() + cur_veh.parts[idx].precalc[0];
            const tripoint partpos = tripoint( partloc, abs_sub.z );
            cur_veh.parts[idx].process_contents( partpos );
        }
    }
    std::vector<int> cargo_parts = cur_veh.all_parts_with_feature( VPFLAG_CARGO, true );
    for( int part : cargo_parts ) {
        process_vehicle_items( cur_veh, part );
    }

    const bool engine_heater_is_on = cur_veh.has_part( "E_HEATER", true ) && cur_veh.engine_on;
    const point veh_pos = cur_veh.global_pos();
    for( auto &active_item : cur_veh.active_items.get() ) {
           ^^^^^ FAILING CALL
        if( cargo_parts.empty() ) {
            return;
       ... function continues

[mlangsdorf]

There's some minor weirdness here in calling if( cargo_parts.empty() ) inside the active_items.get() loop instead of immediately after all_parts_with_features(), but that's not the issue.

I'm not sure how the bike racks code is affecting this bug. The commits between df728fd and 892d9ce don't touch the vehicle active_items cache afaict.

[eturner]

This game saved during the part installation, which must be lucky because if I save right after the part is installed and load it again it doesn't seem to crash
cataclysm-dda.tar.gz

[eturner]

Dropbox alright?
https://www.dropbox.com/s/wce27bxbkzgltgb/cataclysm-dda.tar.gz?dl=1

[alanbrady]

Perfect, although actually the one you attached to your comment just prior was perfect. I'm able to repro with that and am investigating the issue. The issue was trying to download from the .sk domain

[eturner]

These are hers from above
mods.zip

Lama Mama.zip